FlawAtlas
Search the atlas
SUSE-SU-2021:2760-1 Not scored

Security update for c-ares

This update for c-ares fixes the following issues: Version update to git snapshot 1.17.1+20200724: - CVE-2021-3672: fixed missing input validation on hostnames returned by DNS servers (bsc#1188881) - If ares_getaddrinfo() was terminated by an ares_destroy(), it would cause crash - Crash in sortaddrinfo() if the list size equals 0 due to an unexpected DNS response - Expand number of escaped characters in DNS replies as per RFC1035 5.1 to prevent spoofing - Use unbuffered /dev/urandom for random data to prevent early startup performance issues

Exploit probability Not scored
Published August 17, 2021
Required by Not available
Last source change February 4, 2026

02 / AFFECTED SOFTWARE

Affected packages

SUSE:Enterprise Storage 6 c-ares
SUSE:Linux Enterprise High Performance Computing 15-ESPOS c-ares
SUSE:Linux Enterprise High Performance Computing 15-LTSS c-ares
SUSE:Linux Enterprise Module for Basesystem 15 SP2 c-ares
SUSE:Linux Enterprise Module for Basesystem 15 SP3 c-ares
SUSE:Linux Enterprise Server 15 SP1-BCL c-ares
SUSE:Linux Enterprise Server 15 SP1-LTSS c-ares
SUSE:Linux Enterprise Server 15-LTSS c-ares
SUSE:Linux Enterprise Server for SAP Applications 15 c-ares
SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS c-ares
SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS c-ares
SUSE:Linux Enterprise Server for SAP Applications 15 SP1 c-ares
SUSE:Manager Proxy 4.0 c-ares
SUSE:Manager Retail Branch Server 4.0 c-ares
SUSE:Manager Server 4.0 c-ares

03 / CONNECTIONS

Connected vulnerabilities

04 / EVIDENCE

Source records

Open Source Vulnerabilities SUSE-SU-2021:2760-1

This update for c-ares fixes the following issues: Version update to git snapshot 1.17.1+20200724: - CVE-2021-3672: fixed missing input validation on hostnames returned by DNS servers (bsc#1188881) - If ares_getaddrinfo() was terminated by an ares_destroy(), it would cause crash - Crash in sortaddrinfo() if the list size equals 0 due to an unexpected DNS response - Expand number of escaped characters in DNS replies as per RFC1035 5.1 to prevent spoofing - Use unbuffered /dev/urandom for random data to prevent early startup performance issues

View original source

05 / REFERENCES

Further evidence